On Thu, Jul 25, 2019 at 07:22:56PM +0200, Björn Persson wrote:
Jason L Tibbitts III wrote:
> >>>>> "JO" == Joe Orton <jorton(a)redhat.com> writes:
>
> JO> In the historic CVS-based build system which predated what we now
> JO> use, we could do GPG key verification at the time of downloading and
> JO> importing a new tarball.
>
> You're right; tmz dug up a copy of the old Makefile.common file:
>
https://tmz.fedorapeople.org/tmp/Makefile.common
It looks like that searched for and verified signatures when the
packager ran "make download". If they downloaded a new tarball with a
browser, then it would not be verified automatically. The packager
could then download the signature too and run "make download-checks"
manually – if they happened to remember and care. Experience shows that
most people don't care about security until it's too late, so the
verification would often not happen. No one else could know whether the
signature had been verified or not.
Having that functionality back could be a useful tool, but it would not
replace verification during the build, which the packager can't just
forget to do once they have added the one-liner to the spec file.
If you don't enforce GPG verification at or before "fedpkg upload" there
is no assurance that what hits the lookaside cache is trusted, so I
agree - doing this at build time is a good example of not caring about
security until it's too late.
But I assume the FPC is off doing its own thing and will totally ignore
community feedback as normal, so I'll feel free to carry on ignoring FPC
output and this whole conversation is pointless.